CVE-2026-18711 Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory Disclosure

An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries against time-series collections. This could result in a server...

CVE-2026-18711

The CVE-2026-18711 entry concerns MongoDB Server's query execution engine. It describes a use-after-free condition triggered by certain queries against time-series collections, where an authenticated user with read and write privileges can cause an internal reference to be used after memory has b...

CVE-2026-68172

A flaw was found in the Linux kernel, specifically within the hugeptepget helper function for the arm64 architecture. When this function is provided with an unaligned virtual address, it can incorrectly process Page Table Entries PTEs. This can lead to the kernel dereferencing invalid memory...

CVE-2026-68207

A flaw was found in the Linux kernel's media Video Processing Engine VPE driver. This issue occurs during device initialization when a specific resource is unavailable, causing the device to remain improperly registered. As a result, system resources are not correctly released, which could lead t...

CVE-2026-68242

A flaw was found in the Linux kernel's graphics subsystem specifically drm/i915/gt. This vulnerability arises from an improper handling of memory allocation failures during graphics engine scheduling, which can lead to a null pointer dereference. A local attacker could exploit this issue to trigg...

CVE-2026-68218

A flaw was found in the dm1105 PCI driver of the Linux kernel. This issue arises from the driver's failure to properly deallocate resources, specifically a workqueue, when the device is removed. This oversight can lead to a memory leak, which a local attacker could potentially exploit to cause a...

CVE-2026-68205

A flaw was found in the Linux kernel. The v4l2-fwnode module, responsible for video device node management, incorrectly handles module ownership during asynchronous subdevice registration. This can lead to a sensor module's reference count not being properly incremented. As a result, the module m...

CVE-2026-68150

A flaw was found in the Linux kernel. A local attacker could trigger a double-unlock vulnerability in the filesystem's emergency thaw operation. This occurs when the sumount semaphore is released twice, leading to corruption of the semaphore's internal state. This corruption can cause system...

CVE-2026-68209

A flaw was found in the Linux kernel's sun4i-csi media driver. When the startstreaming function fails, the vb2 framework does not properly return queued buffers, causing a buffer leak. This issue could lead to resource exhaustion and potentially a Denial of Service DoS condition on the affected...

CVE-2026-68237

A flaw was found in the Linux kernel's drm/amdgpu/userq component. During a GPU reset, the prereset function only force-completes fences for mapped queues. If a queue is in another state, its last fence remains pending and never signals after the reset. This can cause the eviction/suspend worker...

CVE-2026-68274

A flaw was found in the Linux kernel's drm/xe/guc component. An incorrect calculation of the steered register list allocation size can lead to a buffer overflow. This allows an attacker to write past the allocated buffer, corrupting adjacent memory objects. This memory corruption can result in...

CVE-2026-68228

A flaw was found in the Linux kernel's media subsystem, specifically within the wave5 encoder. A local user could exploit a race condition during encoder processing, where a buffer is returned to userspace before being fully removed from the ready queue. This could lead to a corrupted buffer list...

CVE-2026-68268

A flaw was found in the drm/xe component of the Linux kernel. Non-migratable faults requiring device memory devmem incorrectly suppress error codes, preventing them from being returned to higher layers of the system. This improper error handling could lead to unexpected system behavior or resourc...

CVE-2026-68191

A flaw was found in the Linux kernel's ath12k Wi-Fi driver. When the ath12k driver is unbound, a NULL pointer dereference can occur in the rhash table destroy functions. This issue arises because the hash tables may not be fully initialized before their destroy functions are called unconditionall...

CVE-2026-68256

A flaw was found in the drm/amd/display component of the Linux kernel. This issue occurs in the detectlinkandlocalsink function, where a prevsink reference is not properly released if the DisplayPort DP alt mode timeout path returns false. This missing cleanup can lead to a memory leak, potential...

CVE-2026-68183

A flaw was found in the stratix10-svc firmware component of the Linux kernel. This vulnerability involves memory leaks when memory allocation fails and list corruption due to incorrect memory management and an erroneous list deletion operation. These issues could lead to system instability or a...

CVE-2026-18699 Improper Input Validation in MongoDB Query Planner Leads to Denial of Service

An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service, affecting connecte...

CVE-2026-18699

Technical details about CVE-2026-18699 are not publicly available in the provided documents. Monitor for updates from official advisories.

CVE-2026-18699

An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service, affecting connecte...

EUVD-2026-56880

An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service, affecting connecte...